Title
#fleet
j

jake

09/16/2021, 9:14 PM
Mainly just utilizing this to learn, working on deploying a home lab much like CptOfEvilMinions with Ansible. I am actually trying to include the Polylogx via an extension and using overrides to manage the flag files. Which when i query the flags it has everything that is required, except it is not generating the pipe as seen down below. Which the default Fleet Flag that is where it is listed, which I believe is C:\Program Files\Orbit\osquery.em . Is this correct? Or is this something that Orbit will not create from the TLS Configs?
\\.\pipe\osquery.em
Tomas Touceda

Tomas Touceda

09/16/2021, 9:47 PM
hi jake, the path to that file depends on the root-dir you specify. If you don't specify it, it defaults as you mention to
C:\Program Files\Orbit\osquery.em
. Orbit does create that directory at the beginning
j

jake

09/16/2021, 10:19 PM
Thank you. I'm going to keep playing with it to figure why it's not creating.
4:22 PM
If I add the parameters for overrides for Extensions to autoload, when I query the flags all the overrides are implace. But Extenstions are Inactive when pulling info, as well as querying the extension. Is this something you cant set from the agent_config options utilizing orbit?
Tomas Touceda

Tomas Touceda

09/17/2021, 4:25 PM
not sure I follow, could you show me what you are running, and what you're expecting would happen?
j

jake

09/17/2021, 4:51 PM
I apologize. In the Agent_Options in the Org Config you can provide overrides such as various Flag Files. I have added an extensions.load with an extension directory. I have added the below to the Org Config.
spec:
  agent_options:
    config:
      decorators:
        load:
        - SELECT uuid AS host_uuid FROM system_info;
        - SELECT hostname AS hostname FROM system_info;
      options:
        allow_unsafe: true
        disable_distributed: false
        disable_events: false
        disable_extensions: false
        distributed_interval: 10
        distributed_plugin: tls
        distributed_tls_max_attempts: 3
        enable_ntfs_event_publisher: true
        enable_powershell_events_publisher: true
        enable_windows_events_publisher: true
        enable_windows_events_subscriber: true
        extensions_autoload: \Program Files\osquery\extensions.load
        extensions_require: trailofbits_osquery_extensions,plgx_win_extension
        logger_kafka_acks: all
        logger_kafka_brokers: <plaintext://kafka.brokk.taom.dev:9092>
        logger_kafka_topic: fleettest
        logger_plugin: tls
        logger_tls_endpoint: /api/v1/osquery/log
        logger_tls_period: 10
        ntfs_event_publisher_debug: true
        pack_delimiter: /
        verbose: true
In theory when using orbit it should start those extensions. When I query all the flags, everything is in place as it should based off the options. When using Orbit, it does not launch the extensions. If you use Orbit with Flagfiles, it does not launch it. But if I use osqueryd with the exact same flagfile it launches.
4:53 PM
In theory, I would expect it to load the extension much like osqueryd does with the flagfile.
4:57 PM
I added verbose just to see if i could see anything or do anything cause I was going thru the flags that Fleet brought back.
zwass

zwass

09/17/2021, 5:05 PM
Ah, you can't do
extensions_autoload
as part of the config. It must be part of the flagfile.
j

jake

09/17/2021, 5:13 PM
So would adding that to the agent options, wouldnt that add it to the flags? Cause I can launch orbit, when I pull the flags its listed as part of the flags.
5:13 PM
Sorry if this is a hindrance, i think the platform is awesome. Just trying to find all the stuff I can do with it.
5:14 PM
As seen in that picture all those flags were set via the Override. So I thought it would work. if that makes sense.
j

jake

09/17/2021, 5:18 PM
Awesome thank you very much ill check this out.
zwass

zwass

09/17/2021, 5:19 PM
We need to add support for a flagfile in Orbit. There was actually an open PR for it I'll try to copy over (https://github.com/fleetdm/orbit/pull/30)
5:20 PM
FWIW we do have plans to support configuring osquery startup flags from the Fleet server via Orbit. Not built yet though.
j

jake

09/17/2021, 5:27 PM
Thank you I will check out both of those. I appreciate the help. Makes sense though, that Orbit starts with base configs instead of pulling the configs then starting. I will stop going down this rabbit hole.